[ksprptr]

Before deploying

• AUTH_USERNAME is gone — remove it from the API env.
• AUTH_PASSWORD now holds a bcrypt hash, not the password. The API refuses to start on a
  plaintext value, so set it before deploying:
  pnpm --filter api exec node -e "import('bcryptjs').then((b) => b.hash('your-password', 12)).then(console.log)"
• No DB migration; existing sessions keep working (the refresh tokens are unchanged).

What's in it

• Password-only login — one operator, so there was never a username to check. Gone from the env,
  the DTO, the login form, and the sidebar.
• AUTH_PASSWORD is a bcrypt hash (bcryptjs, cost 12) — the plaintext no longer lives in the
  env or in Coolify. Boot validation rejects a pasted password with the generator command.
• Sessions are issued to a fixed OPERATOR_SUBJECT instead of the username.
• GET /auth/me → { authenticated: true } — it is a session probe now, not an identity.
• bcryptjs over native bcrypt: pure JS, so the alpine image needs no build toolchain.
• Prettier pass over the storage sources and the e2e jest config.

Verification

• pnpm build, pnpm lint, 233 unit and 96 e2e pass.
• Live API run: right password → 200 + both cookies, wrong → 401, a payload still carrying
  username → 400, /auth/me → {"authenticated":true}.
• A plaintext AUTH_PASSWORD fails startup with the generator command in the message.